Skip to content
Threat Feed
Subscribe

Product

Next.js (>= 16.0.0, < 16.3.3)

1 brief RSS
critical advisory

Unauthenticated Remote Code Execution in Next.js Image Optimization API

A critical vulnerability in the libheif dependency used by Next.js allows unauthenticated attackers to achieve remote code execution via malicious AVIF image uploads.

Next.js +1 rce vulnerability web-application nextjs
1t